CVE-2026-30928

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-30928
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30928.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-30928
Aliases
Downstream
Published
2026-03-10T16:15:37.335Z
Modified
2026-04-10T05:42:37.624399Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Glances Exposes Unauthenticated Configuration Secrets
Details

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30928.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/nicolargo/glances

Affected ranges

Type
GIT
Repo
https://github.com/nicolargo/glances
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6037ddaabddacb2ff3344b34d750089861a7a152

Affected versions

v1.*
v1.0
v1.1.2
v1.1.3
v1.2
v1.3
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.4
v1.4.1
v1.4.1.1
v1.4.2
v1.4.2.1
v1.5
v1.5.1
v1.5.2
v1.6
v1.6.1
v1.7
v1.7.1
v1.7.2
v1.7.3
v2.*
v2.10
v2.11
v2.2
v2.3
v2.4.1
v2.4.2
v2.5
v2.5.1
v2.7
v2.7.1
v2.7_RC1
v2.8
v2.8.1
v2.8.2
v2.8.3
v2.8.4
v2.8.5
v2.8.6
v2.8.7
v2.8.8
v2.9.0
v2.9.1
v3.*
v3.0
v3.1.0
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.1.6.1
v3.1.7
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.2.3.1
v3.2.4
v3.2.4.1
v3.2.4.2
v3.2.5
v3.2.6
v3.2.7
v3.3.0
v3.3.0.1
v3.3.1
v3.4.0
v4.*
v4.2.0
v4.3.0
v4.3.0.1
v4.3.0.2
v4.3.0.3
v4.3.0.6
v4.3.0.7
v4.3.0.8
v4.3.1
v4.3.2
v4.3.3
v4.4.0
v4.4.1
v4.5.0
v4.5.0.1
v4.5.0.2
v4.5.0.3
v4.5.0.4
v4.5.0.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30928.json"